Agent Insta

AI-Speed Detection Without Scanning

Traditional vulnerability detection depends on appliance-based or Cloud Agent scans being executed before new exposures can be identified. As a result, organizations need to wait for scan windows and subsequent data collection before understanding their exposure to newly disclosed vulnerabilities.

Agent Insta reduces this delay by continuously correlating vendor advisory intelligence against asset and software inventory that has already been gathered by Qualys. Instead of waiting for the next scan window, Agent Insta identifies the potential exposure as soon as the relevant advisory becomes available.

By leveraging inventory from both Qualys and supported third-party sources, Agent Insta provides rapid visibility into newly disclosed vulnerabilities and publishes findings to the Risk Management view in ETM for investigation.

Agent Insta is not a replacement for VMDR scanning. Rather, it serves as an additional detection capability that helps organizations identify potential exposures sooner and extend visibility into inventory that cannot be actively scanned.

Purpose and Scope

Agent Insta helps you understand your exposure to newly published vendor advisories without waiting for the next scan cycle. Agent Insta is a CVE-driven, scanless detection system that uses normalized asset and CPE intelligence to identify, map, and surface vulnerabilities with low latency and high accuracy.

Agent Insta does not run a scan against your assets. It derives detection from advisory intelligence already matched to inventory it has collected, which is why assets known only through a third-party connector can still return Qualys-flagged findings.

When to Use Agent Insta

The following are key scenarios where Agent Insta can be effectively utilized to enhance your security posture:

• Early Detection of Newly Published Advisories

  See which in-scope assets are affected within minutes, without waiting for a scan window to open.

• For Assets That Cannot Be Actively Scanned

  Cover unmanaged assets and assets reachable only through a third-party connector.

• To Extend Coverage After Adding a Connector

  Newly connected inventory becomes eligible for detection without any additional scan configuration.

• For Continuous Exposure Monitoring

  Detection runs on its own once configured, so exposure information stays up to date between scan cycles.

How Agent Insta Works with VMDR Scanning

Agent Insta is designed to sit alongside your existing detection sources. This section answers the questions most often asked by teams already running VMDR scans and Cloud Agent detection.

Does Agent Insta replace scanning?

No. Agent Insta adds a detection source. It does not change, pause, or replace your scan schedules, Cloud Agent detection, or any existing configuration. Its role is to cover two gaps that scanning alone leaves open: the interval between an advisory being published and your next scan window, and inventory that cannot be actively scanned at all. Scans and Cloud Agents continue to operate exactly as before.

Does Agent Insta create duplicate findings?

No. When InstaScan and another source report the same vulnerability on the same asset, the finding is shown once, and the Sources tab lists each source that reported it. The additional icon in front of the finding title appears only while InstaScan is the sole source; once a scanner, Cloud Agent, or third-party source also reports the finding, that icon is removed and the Sources tab is updated. Your finding counts are therefore not inflated by enabling InstaScan.

Why Agent Insta Matters

• Detection Without a Scan

  Identifies vulnerabilities for in-scope assets without running a scan or without waiting for a scan window.

• Minutes, Not Days

  The agent continuously monitors advisory feeds, surfacing new findings with a median time-to-detect within minutes from advisory processing.

• Expand Coverage for Unscannable Assets
  • Coverage for Assets You Cannot Scan

    Unmanaged assets and assets known only through a third-party connector still receive Qualys-flagged findings, because detection is driven by software inventory rather than by an active probe.

  • First-Party and Third-Party Sources

    Detection works on software inventory from Qualys sensors and from third-party connectors alike. For example, an asset known only through CrowdStrike can carry a Qualys-flagged vulnerability derived from CrowdStrike Spotlight software inventory. Adding a connector immediately extends detection coverage.

  • Third-Party Detection Where None Existed

    Vulnerability detection from third-party sources was not previously available. InstaScan extends detection to inventory supplied by connectors, so an asset known only through CrowdStrike can carry a Qualys-flagged vulnerability derived from CrowdStrike Spotlight software inventory.

• Clear Source Attribution

  Every InstaScan finding is labeled. The Sources tab shows an InstaScan icon and source value, a second icon is displayed in front of the finding title when InstaScan is the only source, and the IsInstaScan QQL token lets you isolate InstaScan findings on demand.

Agent Insta is a detection agent. It does not patch, reconfigure, or otherwise change any asset. Findings are published to Risk Management for your team to triage and act on through your existing remediation workflows.

What Agent Insta Does

What You Get

Agent Insta turns advisory intelligence and existing inventory into findings you can filter, report on, and act on immediately.

• InstaScan Findings in Risk Management

  Agent Insta publishes findings to the Findings tab in Risk Management alongside findings from every other source, with the first found date and confirmed status.

• Source Attribution

  An InstaScan icon and source value on the Sources tab, plus an additional icon in front of the finding title, while InstaScan is the only source that has reported the finding.

• IsInstaScan QQL Token and Filter Card

  Use IsInstaScan: true to return only InstaScan findings, or use the InstaScan detection Summary card to filter the findings list without writing a query.

• Detection Summary Cards

  The cards on the Agent Insta page report the median time to detect, vulnerability coverage across supported technologies, and the total number of findings detected.

Best for These Teams

Teams that benefit most include:

• Risk Operations Centers (ROC)
• Vulnerability Management Teams
• CISOs

Core Skills

Agent Insta excels at these specific capabilities:

• Scanless Detection
• AI-speed Exposure Monitoring
• Zero-Day Rapid Response